The Loan Algorithm Has to Show Its Work

From 2 August 2026, a system that decides whether you get a mortgage in Europe has to show how it reached the no. This is not moral suasion: it is the AI Act entering its binding phase for high-risk systems, and credit scoring is on the list. The conditions for getting a mortgage are the ones you already know, income, payment history, debt-to-income ratio, the value of the property, but from 2 August the bank has to be able to document how it weighed them. Article 11 and Annex IV require precise technical documentation; Article 49 forces the system to be registered in a European database; a firm out of compliance faces fines of up to 3% of worldwide turnover. Explainability just went from optional feature to licence to operate.

For years the standard answer to "why was I refused a mortgage?" was a polite version of "it's complicated." The model has thousands of parameters, the logic doesn't reduce to a sentence, the customer wouldn't understand. The black box was a business model, not a law of nature. It kept the decision out of reach of anyone who wanted to challenge it, and turned a limit on transparency into a convenient shield.

Look at what Annex IV actually asks and the trick shows itself. General description of the system, its purpose, its logic. The data used to train it and that data's limits. Accuracy metrics and the cases where the system fails in predictable ways. The human oversight measures in place. These are exactly the things a team that understands its own system has already written down somewhere. If you don't have them, that gap is a design choice: the system was never built to be inspected. The law doesn't ask you to simplify the neural network. It asks you to be able to open it.

It is an engineer's distinction, and it matters. A production system with no logs is one you can neither appeal nor debug: when something breaks you don't know where to look, and no one outside can hold you to a step you never recorded. Documentation is the decision's log. The black box was a business model because not keeping that log, or not showing it, paid better. Annex IV makes the log a condition of operating, and a decision you have to document becomes a decision someone can contest.

Here Europe adds the piece that closes the loop. France's CNIL, in its May 2026 recommendation on credit, states that every applicant can request a human review of an automated refusal, and sets which data a bank may use to assess solvency: no social media, past payment incidents only where objective and contextualised, capped retention. If you're wondering why your mortgage was denied, from 2 August you have the right to get the answer from a person, not a score. You can inspect only what was made inspectable; you can challenge only what leaves a trace. The right to human review is worth exactly as much as the documentation feeding it, and for the first time the two arrive together.

The strongest objection deserves its due, because it is true. Documentation is not understanding. An Annex IV dossier can become compliance theatre: six hundred pages no inspector will read, written to pass the audit rather than to shed light. Adherence-transparency exists, and regulated sectors have known how to manufacture it for decades. But even theatre leaves a script. A badly documented system stays more contestable than one not documented at all, because the trace is there and someone can read it against whoever wrote it. The threshold moved: opacity used to be the free default, and now it costs.

This is where it reaches whoever builds or buys decision systems, not only the banks. The practical rule is blunt: if you can't document it, you can't defend it, and soon you can't ship it in Europe. Documentability became the right to operate. Whoever built their stack as a closed box, trusting that no one would ask to look inside, now holds a technical debt with a legal deadline. Whoever kept it inspectable from the start finds they are already compliant, because they wrote those logs for themselves, not for Brussels.

The official framing reads all this as a burden: another filing, another form. The mechanism says the opposite. A machine that has to show its work is a machine a human can still contest, correct, overturn. The human keeps the verb, which is the part that counts: to ask, to challenge, to decide in the last instance. Documentation is not the machine's leash. It is the key that keeps it open.

The rest is a question of who answers. A decision with no log has no author to knock on: no one wrote it, no one defends it, and you are left with a no that has no sender. The AI Act, for once, puts a name at the bottom of the page.